Barracuda Networks disclosed two critical vulnerabilities on November 2, 2026. The vulnerabilities, identified as CVE-2026-116606 and CVE-2026-111560, have been assigned CVSS scores of 9.3 and 8.6, respectively.
CVE-2026-116606 is a pre-authentication authorization bypass vulnerability specifically affecting the Email Security Gateway (ESG). CVE-2026-111560 is a command injection vulnerability impacting multiple Barracuda products, including ESG, Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway.
Successful exploitation of these vulnerabilities requires access to the administrative interfaces of the affected devices. Barracuda has urged customers to restrict access to these interfaces and to apply the released patches promptly.
In 2023, Barracuda addressed another vulnerability, CVE-2023-7102, which was exploited by the UNC4841 hacking group. The UNC4841 group also exploited CVE-2023-2868 in cyber-espionage attacks against Barracuda ESG appliances.
Barracuda Networks has more than 200,000 customers worldwide.